Policy pursuant to and by the effect of Article 13 of the European Regulation 2016/679 concerning the protection of personal data (GDPR)
Participants of the New Sneakers Club initiative
Pursuant to and by the effect of Article 13 of the European Regulation 2016/679 (hereafter “GDPR”), LUISA VIA ROMA S.p.A. (hereafter “LUISAVIAROMA or the “Data Controller”) – with registered office in Via Benedetto Varchi, 61 50132, Firenze, Italia – in the capacity of Data Controller of personal data, in the person of the pro tempore legal representative, informs you that Your personal data will be processed by LUISAVIAROMA itself by means of manual or electronic or automated processing, through IT or telematic tools, with principles strictly related to the purposes listed below and, in any case, in order to guarantee the security and confidentiality of the data.
Identity and contact details of the Data Controller and the Data Protection Officer
The Data Controller is LUISA VIA ROMA S.p.A., in the person of the pro tempore legal representative,- with registered office in Via Benedetto Varchi, 61 50132, Firenze, Italia.
The Data Controller has appointed the lawyer Angela Tavaglione as Data Protection Officer (responsible for the protection of personal data) to whom you can contact to exercise your rights or to obtain information relating to them and / or this policy, by writing to LUISA VIA ROMA S.p.A., Via Benedetto Varchi , 61, 50132 Firenze, Italia or by sending an email to dpo@luisaviaroma.com.
Purpose, legal basis, and lawfulness of the processing
Your personal data is processed by the Data Controller pursuant to article 6 of the GDPR. As the aforementioned article states, for it to be lawful, the processing of your personal data should be based on consent or on other legitimate basis provided for by law, taking into account the need to comply with the legal obligation to which the Data Controller is subject or of the need to execute a contract of which you are a party or to execute pre-contractual measures adopted at your request. In the same way, the processing is lawful even if it is necessary for the pursuit of the legitimate interest of the Data Controller, provided that this does not harm the interests, rights and freedoms of your person.
The specific processing purposes and the related legal bases are indicated below:
| Purpose for processing | Legal basis for processing |
| Management of New Sneakers Club | The processing is necessary for the execution of a the contract of which the interested party is a part or for the execution of pre-contractual measures adopted at the request of the same |
Nature of providing and consequences of refusal
Providing personal data is mandatory for the fulfillment of legal and / or contractual obligations and for those processed for the legitimate interest of the Data Controller.
Therefore, any refusal to provide mandatory data will result in the objective impossibility of pursuing the processing purposes referred to in this policy (paragraph “Purpose, legal basis and lawfulness of the processing”).
Categories of recipients of personal data
The personal data provided and those relating to the execution of the contractual relationship may be disclosed to third parties belonging to the following categories:
- Service company for the management of the initiative in question
All persons, who belong to a category that is allowed by law to access the data, will be specifically appointed by LUISAVIAROMA as “Data Processors”, pursuant to article 28 of the GDPR or as autonomous “Data Controllers”.
The data will also be processed by persons specifically authorized for processing by the Data Controller, pursuant to the GDPR. The personal data processed by LUISAVIAROMA are not subject to disclosure.
Transfer of data outside the EU
For the pursuit of the processing purposes described above, your personal data may be transferred to the recipients indicated above in Italy and abroad.
In no case will your personal data be transferred outside the European Union.
Retention period of personal data
he personal data processed by LUISAVIAROMA will be kept for the time necessary for the execution of the contractual relationship, as well as for that prescribed by civil, fiscal, and regulatory laws. Subsequently, the data will be archived until the statute of limitation is reached with reference to the individual rights that can be enforced.
At the end of this period, your data will be anonymized or deleted, unless it is necessary to keep it for other and different purposes provided for by express provision of the law.
Below, the details of the duration of the data retention period for the purposes described above, and the criteria used to determine this period (special categories of personal data are indicated in italics):
| Purpose | Category of personal data | Duration period for cancellation |
| New Sneakers Club | Name, address, or other personally identifiable information | 6 months from the date of closure of the initiative |
| New Sneakers Club | 6 months from the date of closure of the initiative |
Automated decision making
For the pursuit of the processing purposes described above, no decision is made based solely on automated processing that produces legal effects concerning you or that significantly affects your person in a similar way.
Rights of the Data Subject
With regard to LUISAVIAROMA, as the data subject, you may exercise the rights provided to you in the GDPR, in particular, confer the rights to:
a) access and confirmation as to whether or not personal data concerning you is being processed, also in order to be aware of the processing and to verify its lawfulness as well as the correctness and updating of such data. In this case, you will be able to obtain access to your personal data and information, in particular that relating to the purposes of the processing, the type of personal data in question, the recipients or categories of recipients to whom the personal data have been or will be communicated, the retention period, etc.;
b) the correction, where inaccurate, of the personal data concerning you, as well as the integration of the same where considered incomplete, taking into account the purpose of processing. During this period, the Data Controller undertakes not to present the data as certain or definitive, especially to third parties;
c) the deletion of data concerning you, where the data are no longer necessary with respect to the purposes for which they were collected. Please note that cancellation is subject to the existence of valid reasons. If the Data Controller has communicated data concerning you to other Data Controllers or Data Processors, it is obliged to delete them, adopting reasonable measures, including technical ones, to inform other data controllers that they are processing the personal data in question to delete any link, copy or reproduction of the same (so-called right “to be forgotten”). The cancellation cannot be performed if the processing is necessary, among other things, for the fulfillment of a legal obligation or for the performance of a task of public interest and for the ascertainment, exercise or defense in a law in court;
d) the limitation of processing. By limitation of the processing we mean, among other things, also the possibility of transferring the processed data on a system that is no longer accessible, for storage only and unchangeable. This does not mean that the data is deleted but that the Data Controller must avoid using them during the period of the relative block. This would be particularly necessary in the event that a persistent use of inaccurate and illicitly stored data could damage you. In this case, you can oppose the deletion of personal data and request that its use be limited instead. In the case of data rectification or opposition, you can request the limitation of the processing of that data for the period during which the Data Controller is carrying out the rectification or is evaluating the opposition request. A further case is due to the fact that personal data is necessary for you to ascertain, exercise or defend a right in court, but the Data Controller no longer needs it for the purposes of processing;
e) the opposition, at any time, for reasons connected to your particular situation, to the processing of personal data concerning you in cases where the processing itself is necessary for the performance of a task of public interest or connected to the exercise of public powers vested in the Data Controller or if the processing is necessary for the pursuit of the legitimate interest of the same or third parties. Finally, the Data Controller undertakes to refrain from processing your data, unless it can demonstrate that there are compelling legitimate reasons to proceed with the processing or to ascertain, exercise or defend a right in court;
f) to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given prior to the revocation, only for the purposes whose legal basis is consent.
These rights may be exercised by contacting the Data Protection Officer (DPO), by means of a request sent by registered letter with return receipt. to the following address: Via Benedetto Varchi, 61, 50132 Firenze, Italia, or by sending an email to: dpo@luisaviaroma.com
You may also promptly report to the DPO, through the contact details indicated above, any circumstances or events from which, even potentially, a breach of personal data may arise (i.e. any breach of security capable of causing, accidental or illicit, destruction, loss, modification, unauthorized disclosure or access to data), in order to allow immediate evaluation and, where necessary, the adoption of actions aimed at countering the event.
Finally, we remind you that you have the right to lodge a complaint with the Guarantor for the Protection of Personal Data or another supervisory authority pursuant to article 13, paragraph 2, letter d) of the GDPR.
Changes to this policy
This policy is subject to changes. We therefore recommend that you regularly check the this page.
Note: In the event of any inconsistency, discrepancy or divergences of interpretation between the English version and any other language versions of this publication, the English language version shall prevail.
